bottom & links

In July 2015, Russia began penetration of servers at Democratic National Committee (DNC) headquarters, and then exploited stolen documents on Facebook during the 2016 campaign.  Next to nothing was done to protect either the DNC or Facebook from exploitation.  What are the official reports on this episode?

Here is a condensed re-write of: Information Operations and Facebook, 27Apr2017, 13pp

enriched by the Director of National Intelligence report 6Jan2017, 25pp.

     EDITOR: J. I. Nelson, IEEE

Today, civic engagement takes place in an "information ecosystem" rapidly evolving with the planet's own globalization, something driven in turn by the information networks on which Facebook is another "platform".  In today's civic discourse, anyone can have access, and then produce as well as consume; everyone experiences:

     an increased speed and
     an increased scale of impact.

[EDITOR: These social platforms could arise on big, fiber-optic networks once software arose to manage "big data" deployed across globally-distributed data centers and managed on elastically growing and contracting drive arrays.]

The network's immediacy, reach, and always-on persistence changes contact on them from person-to-person messaging into group-social interactions.]

Social networks have social amplification. Everyone is a potential social amplifier, and social amplification varies with social passions, not with truth.

False amplifiers can be created with false accounts on any social network.  The account creation is performed by paid staff of government or non-state actors.  The creation of a "large numbers of sparsely populated fake accounts that ... engage with content at high volumes" is not currently well-automated.  Following account creation, engagement for false social amplification requires "people with language skills and a basic knowledge of the political situation in the target countries".  [EDITOR: Director of National Intelligence 6Jan2017 says these people work in St. Petersburg at the Internet Research Agency funded by a close Putin ally.]

False amplifiers must arouse passions, perhaps through sensationalism, to achieve social amplification of their message.  False news is used for passion-arousing sensationalism, as well as for the deception itself.  Deception is pursued with disinformation methods that include black propaganda (false flag news): "seeding stories to journalists . . ., including via fake online personas". [EDITOR: e.g., "Gucifer", below.]


FACEBOOK: "...we believe that campaigns based upon leaked or stolen information can be especially effective in driving engagement" because of their high inherent amplification factor.

For the Democratic National Committee and John Podesta e-mail leaks, FACEBOOK believes that there was "reconnaissance", "cyber operations against individuals" using "malware" on a few machines to exfiltrate "credentials" for many other machines, followed by "spearphishing" those other machines, or "account-takeover" where user/password credentials were already available, and then "data theft" from the entire server.  With "account takeover", there is no need for "targeted data collection" by malware, as the entire server can be exfiltrated. [EDITOR: "In July 2015, Russian intelligence gained access to Democratic National Committee (DNC) networks and maintained that access until at least June 2016." --Director of National Intelligence report of 6Jan2017. FACEBOOK "believes"/accepts these findings, and admits to no forensics of their own.]

"Content Creation" then began, by "seeding of stories to press, meme and story generation, and fake account/persona creation" on FACEBOOK's own platform.

[SOCIAL AMPLIFICATION, EDITOR: The initial "amplifiers" were individual bloggers with whom case officers (operatives) might have had contact, now approached by concealed-identity, online sources or "personas".  The most famous persona was Gucifer 2.0 -- the original Gucifer, 1.0 as it were, is a Romanian now in jail.  Gucifer 2.0 was a front for more than one individual and a source of stolen Democratic party documents before they were dumped wholesale onto WikiLeaks. Later amplification used social media platforms, where false amplifier groups running on false accounts have to be set up ahead of time to launch a social response.]

FACEBOOK describes early amplifiers on their own platform as "a smaller number of carefully curated accounts that exhibit authentic characteristics with well-developed online personas."

"False amplification" proceeded with "fake accounts spreading memes [easily-perceived logos and mythology] and content, creation of astroturfing groups, and comment[-area] spam."

FACEBOOK believes the intent was:

1. "Promoting or denigrating a specific cause or issue.
2. "Sowing distrust in political institutions.
3. "Spreading confusion . . . muddying civic discourse and
        pitting rival factions against one another.
        In several instances, we identified malicious actors on FACEBOOK who,
        via inauthentic accounts, actively engaged across the political spectrum
        with the apparent intent of increasing tensions between supporters
        of these groups and fracturing their supportive base."


For [implicitly] the John Podesta emails, FACEBOOK states:

-- "private...information was accessed and stolen;"

-- "Dedicated sites hosting this data were registered;"

-- "Fake personas were created on Facebook and elsewhere to ...amplify awareness of this

-- Entire social media "pages were created to amplify news accounts of, and
        direct people to, the stolen data;" [EDITOR: a social media "page" is
        yesterday's Internet "home page," with, today perhaps, separate
        pages/screens for education and places lived, photos, movies I recently
        watched, my thoughts for the day -- all of them cluttered up with
        comments from "friends".]

-- "From there, organic proliferation of the messaging and data through
        authentic peer groups and networks was inevitable." [EDITOR: 'viral'

FACEBOOK wishes to remind us that, although a "set of malicious actors engaged in false amplification", "the reach of the content spread by these accounts was less than one-tenth of a percent of the total reach of [all] civic content on FACEBOOK."

[EDITOR RESPONDS: The 300 petabytes of data already in FACEBOOK's data centers three years ago is incomprehensibly large, is a pile of the biggest, most expensive hard drives today -- 10 terabytes each -- three-quarters of a kilometer high.  This renders trivial by comparison anything FACEBOOK has failed to detect, control, or clean out.]

"Facebook is not in a position to make definitive attribution . . . however our data does [sic] not contradict the attribution provided by the U.S. Director of National Intelligence" [DNI] in the 6 Jan 2017 report, "Assessing Russian Activities and Intentions in Recent US Elections,"



The FBI, CIA, and NSA are confident Russia used paid media trolls, and sought to undermine Clinton's future as President when they thought she had one, and undermine her campaign when they thought it could be killed.  Putin directed this campaign.

Also: "Russian intelligence obtained and maintained access to elements of multiple US state or local electoral boards" and "researched US electoral processes and related technology and equipment" since early 2014, but [EDITOR] chose not to preferentially block voters by changing registration rolls, enter voting machines to change machine tallies, or interfere with the totalizing network for all machines, the DNI implies, albeit it is now too late to confirm such assertions with an audit.


False amplification from fraudulent accounts has a technical fingerprint:
--synchronized account creation
--synchronized content posting
--synchronized responses ("likes", re-postings)
--episodic bouts of content creation

Detecting synchronization does not require FACEBOOK to judge content.


Foreign financing that leaves [mis-]information operations "not constrained by per-unit economic realities" makes detection by FACEBOOK more complex.  Nevertheless, FACEBOOK could "take action against over 30,000 fake accounts" in France as of April 13. [Emmanuel Macron and Marine LePen emerged as front-runners on the 23 April 2017 first-round election; Macron's final win was 7 May 2017.]


High-profile FACEBOOK users get high-sophistication attacks.  FACEBOOK has to be "working directly with government bodies" to achieve the extra protections needed for such targeted individuals, and targets must also act when notified by FACEBOOK.

New Facebook "products" (user pop-ups) lower the social amplification factor.

The dear old days of individuals abusing other individuals (stealing an account and its identity, abusing and stalking a person online or flooding a forum  with spam) are now eclipsed by the larger problems discussed here, FACEBOOK notes with apparent pride and perhaps a touch of sadness.

top -- you are reading how Russia used Facebook's platform
The March for Science, 2017 - a photoessay
Climate March, 2017 - a photoessay
home for this website, such as it as
A happier website with a couple travel photoessays

Rev 20May202017                 asdf